CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting CVE-2026-97229. This GitLab vulnerability could allow code execution without logging in.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 29, 2026, confirming evidence of active exploitation and raising the urgency for organizations running affected GitLab servers.

The vulnerability affects GitLab Community Edition and Enterprise Edition. It involves an integer overflow or wraparound caused by insufficient checks on regular expressions inside CI/CD configurations. A specially crafted expression could allow an unauthenticated attacker to execute arbitrary code on the GitLab server.

Cybersecuritynews.com previously covered the technical details in its report on the GitLab code execution vulnerability. Regular expressions are text patterns used to match or filter data. In this case, the dangerous input reaches GitLab’s regular expression compiler through a CI/CD configuration.

These configurations define automated development tasks. Processing a malicious pattern could affect the server itself, not just cause a pipeline task to fail.

GitLab Integer Overflow Vulnerability Exploited

An integer overflow occurs when a calculation produces a number outside the range a program can store. The resulting value can become unexpectedly small or negative. MITRE’s CWE-190 description explains that these errors can cause crashes, memory corruption, or unauthorized code execution, depending on how the software uses the value.

GitLab assigned the flaw a maximum CVSS score of 10.0. Earlier reporting identified affected versions as 19.2 before 19.2.8, 19.3 before 19.3.4, and 19.4 before 19.4.2. Those branches received fixes on October 12. Administrators should review their installed release and follow the current vendor update guidance.

The supplied catalog entry lists November 1, 2026, as the remediation deadline and marks forensic triage as required under BOD 26-04. It lists ransomware use as unknown. That status does not establish a ransomware link, and CISA’s public alert does not identify attackers, victims, or the scale of exploitation.

CISA’s October 29 alert explains that BOD 26-04 requires federal civilian agencies to prioritize high-risk vulnerabilities on exposed assets.

The directive also requires, where applicable, checks for signs that attackers compromised a system before updates were applied. CISA encourages other organizations to adopt similar risk-based patching practices.

Administrators must also avoid confusing this issue with CVE-2026-110264, a separate GitLab regular expression vulnerability disclosed later in October.

Cybersecuritynews.com’s coverage of that separate GitLab server vulnerability explains that installing the earlier CVE-2026-97229 update does not fix the newer issue.

Reviewing both advisories helps teams choose an update that addresses both vulnerabilities rather than leaving another code execution path open on their GitLab servers.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks appeared first on Cyber Security News.